Contents

Issue

Two Umbrella Virtual Appliances (VAs) in the same region were experiencing intermittent status changes from green to red. One VA remained stable while the other intermittently lost connectivity to Umbrella

Environment

- Technology: Security - Network Protection

- Sub-technology: Umbrella - Virtual Appliance (VAs)

- Two Umbrella Virtual Appliances deployed in the same region

- Network infrastructure with edge router configuration

- ISP connectivity for internet access

Resolution

The resolution involved identifying and addressing a network-level configuration issue that was blocking UDP traffic on port 5353. The following diagnostic and resolution steps were taken:

Diagnostic Steps Performed

Step 1: Initial Diagnostic Data Collection

Traceroute screenshots and show-tech bundles were collected for both VAs to compare their connectivity patterns and identify the scope of the issue.

Step 2: Network Connectivity Testing

Firewall and perimeter edge router tests were conducted to verify UDP port 5353 reachability, which consistently returned "destination not reached" responses for the affected traffic.

Step 3: Service Process Verification

Analysis of the show-tech bundle confirmed that the umbrella-connector process was running properly on the affected VA, indicating that the issue was not with the internal VA processes but rather with network connectivity.

Step 4: ISP Investigation

A case was opened with the Internet Service Provider to investigate UDP port 5353 reachability issues at the network level.

Root Cause Identification and Resolution

The underlying cause was identified as UDP port 5353 not being enabled on the edge router configuration. This network-level blockage prevented the affected VA from establishing proper connectivity to Umbrella DNS services over UDP port 5353, while TCP port 443 traffic remained unaffected.

Step 5: Edge Router Configuration Correction

The edge router configuration was updated to enable UDP port 5353, allowing proper communication between the Umbrella VA and the Umbrella DNS-over-UDP endpoint.

Cause

The root cause of the intermittent Umbrella Virtual Appliance connectivity issues was a network configuration problem where UDP port 5353 was not enabled on the edge router. This blocking prevented the affected VA from establishing proper DNS-over-UDP connectivity to Umbrella services, while TCP traffic on port 443 remained unaffected. The issue manifested as intermittent health check failures because the VA could not consistently reach the Umbrella DNS endpoint over the required UDP port 5353 protocol.

Related Content

- Cisco Technical Support & Downloads